CVE-2026-31816: Budibase Auth Bypass Vulnerability

CVE-2026-31816 Overview

CVE-2026-31816 is a critical authorization bypass vulnerability affecting Budibase, a low code platform for creating internal tools, workflows, and admin panels. In version 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request.

The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. This allows a completely unauthenticated, remote attacker to access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL.

Critical Impact

Complete authentication and authorization bypass allows unauthenticated remote attackers to access any protected API endpoint, potentially leading to full application compromise, data theft, and unauthorized administrative actions.

Affected Products

• Budibase versions 3.31.4 and earlier
• Budibase server-side API endpoints protected by authorized() middleware
• All Budibase deployments using the default authentication middleware

Discovery Timeline

• 2026-03-09 - CVE CVE-2026-31816 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31816

Vulnerability Analysis

This vulnerability represents a classic authorization bypass due to improper input validation in the authentication middleware. The core issue lies in how Budibase determines whether a request should bypass authentication checks. The isWebhookEndpoint() function is intended to allow unauthenticated access to legitimate webhook endpoints, but the implementation flaw allows attackers to exploit this mechanism for any endpoint.

The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), as the unanchored regex pattern fails to properly validate the request path, allowing injection of webhook patterns into query parameters to bypass security controls.

The attack can be executed remotely over the network without any prior authentication or user interaction. An attacker can achieve high impact to both confidentiality and integrity by gaining unauthorized access to sensitive data and performing unauthorized modifications through the bypassed API endpoints.

Root Cause

The root cause is an improperly anchored regular expression in the isWebhookEndpoint() function. The regex is designed to match webhook endpoint patterns but tests against the full URL including query parameters (ctx.request.url in Koa framework). Since the regex is unanchored, it matches the webhook pattern anywhere in the URL string, including within query parameters. When a match is found, the middleware immediately skips all security checks by calling return next(), effectively granting unauthenticated access to any endpoint.

Attack Vector

The attack is trivially executed by appending a webhook pattern to the query string of any protected API endpoint. For example, an attacker can append ?/webhooks/trigger to any API URL, causing the isWebhookEndpoint() function to return true. This triggers the early return in the authorized() middleware, bypassing:

• Authentication checks
• Authorization and role verification
• CSRF protection mechanisms

The attack requires no authentication, no special privileges, and no user interaction. Any network-accessible Budibase instance running version 3.31.4 or earlier is vulnerable.

The vulnerability mechanism involves the unanchored regex matching against the full URL. When a request is made to a protected endpoint such as /api/admin/users?/webhooks/trigger, the regex finds the webhook pattern in the query string and incorrectly identifies the request as a legitimate webhook endpoint, bypassing all security controls.

For detailed technical analysis, see the GitHub Security Advisory.

Detection Methods for CVE-2026-31816

Indicators of Compromise

• HTTP requests to API endpoints containing /webhooks/trigger or similar webhook patterns in query parameters
• Unusual access to administrative or sensitive API endpoints from unauthenticated sessions
• Spike in API requests with query strings containing webhook path patterns
• Access logs showing successful responses to protected endpoints without corresponding authentication events

Detection Strategies

• Monitor web server access logs for requests containing webhook patterns (e.g., /webhooks/, /webhooks/trigger) in query string parameters
• Implement Web Application Firewall (WAF) rules to detect and block requests with suspicious query parameters matching webhook patterns
• Analyze authentication logs for discrepancies between successful API access and missing authentication events
• Deploy runtime application self-protection (RASP) to detect authorization bypass attempts

Monitoring Recommendations

• Enable detailed access logging on Budibase server instances to capture full request URLs including query parameters
• Configure SIEM alerts for patterns matching \?.*\/webhooks\/ in request URLs
• Monitor for unauthorized access to sensitive endpoints such as user management, configuration, and data export APIs
• Implement anomaly detection for API access patterns that bypass normal authentication flows

How to Mitigate CVE-2026-31816

Immediate Actions Required

• Upgrade Budibase to a patched version beyond 3.31.4 immediately
• Review access logs for evidence of exploitation attempts using webhook pattern query strings
• Implement network-level restrictions to limit access to Budibase instances until patching is complete
• Consider temporarily disabling external access to the Budibase server if immediate patching is not possible

Patch Information

Organizations should update Budibase to the latest available version that addresses this vulnerability. The fix involves properly anchoring the regex in the isWebhookEndpoint() function to ensure it only matches legitimate webhook endpoint paths and not arbitrary query parameter values. Refer to the GitHub Security Advisory for official patch information and upgrade instructions.

Workarounds

• Deploy a reverse proxy or WAF rule to block requests containing webhook patterns in query parameters
• Implement IP allowlisting to restrict access to trusted networks until a patch can be applied
• Configure network segmentation to isolate Budibase instances from untrusted network segments
• Monitor and alert on any requests matching the exploitation pattern while awaiting patch deployment

# Example WAF rule to block exploitation attempts (ModSecurity syntax)
SecRule QUERY_STRING "@rx /webhooks/" "id:100001,phase:1,deny,status:403,msg:'CVE-2026-31816 exploitation attempt blocked'"